4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A small enterprise wants to use Cisco ISE to authenticate administrators accessing their network devices. They only need authentication (no per-command authorization) and want to minimize configuration complexity. They already use RADIUS for wireless authentication. Which approach is most appropriate?

   • AUse local device accounts and disable AAA to avoid integration overhead.
   • BConfigure ISE as a RADIUS server for device administration, using the existing RADIUS infrastructure and defining a device administration policy set for authentication.
   • CConfigure ISE as a TACACS+ server and create a single policy set that allows all commands.
   • DSet up both RADIUS and TACACS+ on ISE and configure devices to try RADIUS first, then TACACS+.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An organization has multiple network device groups: core routers, access switches, and firewalls. They want to enforce different administrative policies: for example, only senior engineers can configure core routers, while junior staff can only view configurations on access switches. They plan to use Cisco ISE for device administration. What is the best way to implement this?

   • ACreate a single device administration policy set with a command set that allows all commands, and rely on the device's local privilege levels.
   • BUse RADIUS with vendor-specific attributes to allow or deny configuration commands on a per-device basis.
   • CDefine device groups in ISE, create separate command sets for 'show' and 'configure', and build policy sets that match on device group and user group to assign the appropriate command set.
   • DConfigure each device with its own local user accounts and command authorization lists.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security admin needs to ensure that network administrators can only execute 'show' commands and 'ping' on production devices, but they can execute any command on lab devices. They are using Cisco ISE for TACACS+ device administration. What should they configure?

   • AUse RADIUS and send the 'cisco-av-pair' attribute with shell:priv-lvl=1 for production and priv-lvl=15 for lab.
   • BCreate a single policy set that allows all commands, and rely on the device's enable password to restrict access.
   • CCreate a command set for production that includes only 'show' and 'ping', and another command set for lab that includes 'permit all'. Then create two policy sets: one matching production device group and one matching lab device group.
   • DConfigure the devices to use local command authorization lists, and use ISE only for authentication.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company wants to use Cisco ISE to authenticate administrators who connect via SSH to their Cisco routers. The routers are configured with 'aaa authentication login default group tacacs+'. The administrators use a variety of clients, some of which only support PAP. Which authentication protocol should be configured on ISE to ensure compatibility?

   • APAP
   • BEAP-TLS
   • CMSCHAP
   • DCHAP
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security auditor requires evidence of who accessed network devices, what commands they executed, and when. The organization uses Cisco ISE for TACACS+ device administration. What must be enabled to meet this requirement?

   • AEnable RADIUS accounting on ISE and configure devices to send accounting start/stop records.
   • BEnable ISE's reporting feature and generate a report of all authentication events.
   • CUse the device's local logging and send syslog to a central server.
   • DEnable TACACS+ accounting on ISE and configure the devices to send accounting records to ISE.
   Reveal Solution Discussion Select an answer first